Skip to main content

Linux Kernel CVE-2026-74538

| EUVDEUVD-2026-59731 HIGH
2026-08-15 Linux GHSA-hqwp-mg54-6754
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition timing dependency warrants AC:H over vendor AC:L; AV:A confirmed by Bluetooth proximity requirement; PR:N as no Bluetooth authentication is needed to send ISO connection indications.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:16 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: lock sk in iso_connect_ind

Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking.

Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.

AnalysisAI

Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position within Bluetooth radio range
Delivery
Target running active Bluetooth ISO socket in LISTEN or CONNECT state
Exploit
Send crafted LE ISO connection indication (ev3 event)
Execution
Race ev3 handler against concurrent socket state transition
Persist
Access iso_pi(sk)->conn without lock_sock
Impact
NULL pointer dereference or kernel memory corruption
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target system must have Bluetooth enabled and an active socket in the ISO LISTEN or CONNECT state, meaning it must be running Bluetooth LE Audio or another application that uses the Bluetooth ISO profile - this is not a default configuration on general-purpose servers or workstations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 8.8 (AV:A/AC:L/PR:N/UI:N) captures a significant adjacent-network exposure reachable without authentication, consistent with Bluetooth's radio proximity constraint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range (typically 10 to 100 meters depending on device class) sends crafted Bluetooth LE ISO connection indication events to a target system running a vulnerable kernel with an active Bluetooth ISO socket. During processing of the ev3 event, the kernel accesses iso_pi(sk)->conn without holding the socket lock; if a concurrent thread simultaneously transitions the socket away from LISTEN or CONNECT state, the resulting NULL or stale pointer dereference causes a kernel panic or memory corruption. …
Remediation Upgrade to Linux kernel 6.18.44, 7.1.8, or 7.2-rc6 or later, which incorporate the fix adding proper lock_sock/release_sock pairs around the ev3 path in iso_connect_ind() and a post-lock validity recheck of hcon. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory systems running Linux kernel versions 6.8.9 through pre-6.9, with priority focus on production systems with Bluetooth connectivity (IoT, edge nodes, embedded devices). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74538 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy